PfSense Proxy under VM Ware with multiple Vlan

haiz

Hi Guys,

a couple days ago, i was tried to install pfsense as proxy server (actually i was planned to use it as url filter with dansguardian or squidGuard) but I wasn't able to make the squid work.

My topology was look like this

Internet –-Cisco router (2901) ---Cisco 3850 (Core)----Cisco 2960
|
|
Mikrotik (Gateway)
|
|
pfSense Proxy

I have cisco 3850 acting as a core switch and i configured the vlan interface in it. and then my mikrotik acting as a gateway and dhcp server and last, i put proxy under the mikrotik and capture all user traffic using nat so that can be handle by a proxy.

When i activate the squid and nat user traffic on mikrotik, it always shows "invalid request". i've been wondering on the internet i can't seem to find the correct solution for my problem. Maybe you guys here know to solve my issue and can help me to get this done.

Thank You

johnpoz

Why would you set it up like that, so you want hairpin traffic through 2 different devices.. Why do you think you need mikrotik? In the mix?

Also to be honest why even pfsense? While yes pfsense has a package for it squid. If all you want to do is use proxy.. Why not just setup a box as a proxy on whatever OS your more comfortable with… Pfsense is really meant to be your router/firewall... Someone wrote a package for it to also allow you to leverage it as a proxy..

If you were going to do
internet - pfsense - yournetwork

Then sure makes sense to run the proxy and content filtering on it... But in your setup I don't see how it makes sense at all..

haiz

well, thanks for the reply. about why i use pfsense. because want squid with "GUI". That's all.

johnpoz

So you want to run something you have no clue how to use at all is my take on that, and what amounts to a idiot proof setup.. What I would suggest is you understand how to properly place a proxy in your network before you think of running one..

You have a cisco router and managed switches, you don't show any lan side but you do show another downstream switch and mention "core" are you doing layer 3 at the 3850? Just at a loss to why you think to throw another router into the mix? More than likely wccp would be well suited for your setup, when you don't want to put the proxy at the edge.

https://en.wikipedia.org/wiki/Web_Cache_Communication_Protocol